- Reporting security problems to WIP
- Security Point of Contact
- Incident Response Process
- Vulnerability Management Plans
DO NOT CREATE AN ISSUE to report a security problem. Instead, please send an email to wip.incident-response@martynus.net
The security point of contact is Gregor Martynus. Gregor responds to security incident reports as fast as possible, within one business day at the latest.
In case Gregor does not respond within a reasonable time, the secondary point of contact is Brandon Keepers. Brandon is the only other person with administrative access to the WIP App Settings.
If neither Gregor nor Brandon responds then please contact support@github.com who can disable any access for the WIP app until the security incident is resolved.
In case an incident is discovered or reported, I will follow the following process to contain, respond and remediate:
The first step is to find out the root cause, nature and scope of the incident.
- Is still ongoing? If yes, first priority is to stop it.
- Is the incident outside of my influence? If yes, first priority is to contain it.
- Find out knows about the incident and who is affected.
- Find out what data was potentially exposed.
One way to immediately remove all access for the WIP app is to remove the private key from the WIP App Settings page. The access can be recovered later by generating a new private key and re-deploy the app.
After the initial assessment and containment to my best abilities, I will document all actions taken in a response plan.
I will create a comment in the official "Updates" issue to inform users about the incident and what I actions I took to contain it.
Once the incident is confirmed to be resolved, I will summarize the lessons learned from the incident and create a list of actions I will take to prevent it from happening again.
The WIP App uses the least amount of access to limit the impact of possible security incidents, see Information collection and use.
If someone would get access to the WIP app, the worst thing they could do is to read out contents from pull requests, limited to repositories the WIP got installed on.
The WIP GitHub Organization requires 2FA authorization for all members.
We learn about critical software updates and security threats from these sources
- GitHub Security Alerts
- Greenkeeper Dependency Updates
- GitHub: https://githubstatus.com/ & @githubstatus
- Zeit (Hosting): https://zeit-status.co/ & @zeit_status
- Travis (CI/CD): https://www.traviscistatus.com/ & @traviscistatus